Re: [TLS] Quest for Unified Solution to TLS Renegotiation

[Hovav Shacham <[e-mail]>]

On Nov 25, 2009, at 2:54 PM, Eric Rescorla wrote:

> This requires breaking the current clean definition of handshake
> hashes as the hash of all the handshake messages and simply adding
> some synthetic message in the middle.
> [...]
> By contrast, RI allows that part of the system (which is well
> understood) to remain the same and in fact when RI is offered on the
> first handshake, there is no change to the TLS core at all.

FWIW, I much prefer the RI approach.  It leverages more of the  
preexisting TLS machinery, which makes is easier to reason about and  
more likely not to break things.

Hovav.